[UNIX] openssl 이용 평문 패스워드 암호화 하기

  

**** (중요) 비밀번호가 하드코딩되어 있는 쉘의 비밀번호를 직접 노출되지 않도록 변경 ****

1. 비밀번호 평문파일 생성(root)

  /tmp/pwd.txt 에 계정 암호 형식으로 텍스트 생성
  (주의 : “특수”한 특수문자 포함 시 (ex. @ 등 일반적으로 DBMS에서 사용하지 않는 특수문자) 비밀번호 앞뒤로 "를 포함하여 입력)
 

 EX>
/tmp/pwd.txt

 scott  tiger
 testuser  "test@pw"

 
2. 각종 환경설정(root)

  echo p@ssw0rd > /etc/environment-key
  /usr/bin/openssl genrsa -aes256 -passout pass:`cat /etc/environment-key` -out /etc/environment-key-priv 2048        <<<<<<<<<<<<<  private key 생성, 생성도 dba만 아는 비밀번호(pass phrase)로(priv_key_dba)
  /usr/bin/openssl rsa -in /etc/environment-key-priv -passin pass:`cat /etc/environment-key` -out /etc/environment-key-pub -outform PEM -pubout     <<<<<<<<<<<<<  private에 대응하는 public 키 생성

 
3. 비밀번호암호화(root)

  /usr/bin/openssl rsautl -encrypt -inkey /etc/environment-key-pub -pubin -in /tmp/pwd.txt -out /etc/environment-dbms.enc   <<<<<<<<<<<< 공개키로 비밀번호 파일 암호화

 
4. dec.sh 파일 생성(root)

  vi /usr/bin/dec.sh

  #!/bin/ksh
  # Purpose: Decrypt file
  /usr/bin/openssl rsautl -decrypt -inkey /etc/environment-key-priv -passin pass:`cat /etc/environment-key`  -in /etc/environment-dbms.enc


5. 파일권한 정리(root)

  chown root.dba /etc/environment-key
  chown root.dba /etc/environment-key-priv
  chown root.dba /etc/environment-key-pub
  chown root.dba /etc/environment-dbms.enc
  chown root.dba /usr/bin/dec.sh
  chmod 640 /etc/environment-key
  chmod 640 /etc/environment-key-priv
  chmod 640 /etc/environment-key-pub
  chmod 640 /etc/environment-dbms.enc
  chmod 750 /usr/bin/dec.sh


6. 테스트(root, oracle, patrol 등 sqlplus사용하는 모든 계정)
(dba 그룹에 실행 권한이 있습니다)

  openssl rsautl -decrypt -inkey /etc/environment-key-priv -passin pass:`cat /etc/environment-key`  -in /etc/environment-dbms.enc <<<<<<<< 개인키로 비밀번호 파일 복호화  (화면에 출력확인)
 dec.sh (화면에 출력확인)

 
7. 정리(root)
  rm -f /tmp/pwd.txt
 

8. 위와 같이 세팅 후 비밀번호가 하드코딩되어 있는 쉘의 비밀번호를 아래와 같이 직접 노출되지 않도록 쉘의 내용 변경

(사용 EX)

변경 전

sqlplus -s scott/tiger @/dba/dailycheck/test01.sql

 

변경 후

USR=scott
PASSWD=`/usr/bin/dec.sh | grep -i ${USR} | awk '{ print $2 }'`

sqlplus -s ${USR}/${PASSWD} @/dba/dailycheck/test01.sql

 

 

추후 관리

※ 비밀번호 변경 시 (root, 아래와 같이 암호화된 파일을 다시 세팅해야 함)

(root)

/usr/bin/openssl rsautl -encrypt -inkey /etc/environment-key-pub -pubin -in "비밀번호정보평문파일" -out /etc/environment-dbms.enc

chown root.dba /etc/environment-dbms.enc

chmod 640 /etc/environment-dbms.enc

rm "비밀번호정보평문파일"

 

※ dba코드를 수정하고 싶을 시(root)

echo 수정하고싶은코드입력 > /etc/environment-key

chown root.dba /etc/environment-key

chmod 640 /etc/environment-key

 

※ sqlplus 텍스트 찾는 쉘(.sh파일) (root)

find / -name "*.sh" -type f 2>/dev/null| xargs grep sqlplu 2>/dev/null  | grep -iv "/ as sysdba" ## find .sh file which include "sqlplu"